200-201 Question 367
Single answerA cybersecurity analyst is monitoring the performance of a network intrusion detection system (NIDS) deployed in an enterprise environment. The NIDS is configured to analyze network traffic at a maximum throughput of 1 Gbps. During a simulated attack, the analyst notices that the system starts dropping packets when traffic exceeds 800 Mbps. Which of the following actions would most effectively address this issue?
- A
Upgrade the hardware of the NIDS to handle higher throughput.
- B
Reduce the number of signatures analyzed by the NIDS.
- C
Increase the size of the NIDS storage to handle more log data.
- D
Deploy an additional NIDS to share the traffic load.
Show answer and explanation
Correct answer: A
Explanation
The NIDS throughput issue arises from its hardware limitations in processing traffic beyond 800 Mbps. Upgrading the hardware to handle higher throughput directly addresses the bottleneck without compromising detection accuracy or introducing architectural complexity.
- A. Correct.
Upgrading the hardware of the NIDS to handle higher throughput is the most effective solution. This ensures the system can process the increased traffic without dropping packets, addressing the throughput limitation.
- B. Incorrect.
Reducing the number of signatures analyzed by the NIDS might help marginally but could compromise detection accuracy and is not a long-term solution to the throughput problem.
- C. Incorrect.
Increasing the size of the NIDS storage does not resolve the issue since storage deals with log retention and not real-time traffic processing.
- D. Incorrect.
Deploying an additional NIDS to share the traffic load could be a valid option in some architectures, but it introduces complexity and is not as straightforward as upgrading the existing system.